What is OWASP and Why Does It Matter for OutSystems?
- Charos Abdukayumova
- Apr 10
- 4 min read
When you think about application security, you might picture firewalls, penetration testing, or even a team of security engineers reviewing lines of code. But did you know that some of the most important security decisions are made before a single line of code is executed?
This is where OWASP comes in.
What is OWASP?
OWASP stands for the Open Worldwide Application Security Project. It’s a non-profit organization with one goal: To help developers build secure software.
OWASP provides free and open-source resources that guide professionals in identifying and fixing common security risks in applications — whether you’re writing traditional code or using a low-code platform like OutSystems.
The OWASP Top 10
The most well-known contribution from OWASP is the OWASP Top 10 — a regularly updated list of the most critical web application security risks.
Here’s a quick look at the current Top 10, how they can show up in OutSystems, and most importantly, how to prevent them. You can check out here or here for more information.
1. Broken Access Control
The Risk: Users can access data or perform actions they shouldn’t be allowed to — for example, by manipulating URLs, bypassing client-side checks, or calling APIs directly to view or modify other users’ information.
In OutSystems: Screens or server actions that don’t check user roles.
How to Prevent It:
Use Role-based access control (RBAC) consistently.
Validate permissions not just on the UI, but also on server actions.
Never trust client-side checks alone, it can be easily manipulated.
2. Cryptographic Failures
The Risk: Sensitive data (passwords, personal info) is stored or transmitted insecurely.
In OutSystems: Storing sensitive data in plain text, or weak hashing algorithms.
How to Prevent It:
Always use OutSystems’ built-in password encryption for user entities.
Use Forge components like CryptoAPI for encryption/decryption.
Avoid creating your own cryptographic logic unless absolutely necessary.
Use Secure Site Properties if needed.
3. Injection
The Risk: Malicious data input leads to SQL injection, OS command injection, etc.
In OutSystems: Unsafe input used in SQL queries, especially dynamic ones.
How to Prevent It:
Use input parameters in SQL queries — OutSystems escapes these safely.
Avoid concatenating SQL manually.
Sanitize user input if passing to external systems.
Prevent XSS (Cross-Site Scripting) by using Encode(), EncodeHTML(), EncodeJavaScript() , etc.
4. Insecure Design
The Risk: Applications are insecure by design due to missing threat modeling or secure architecture.
In OutSystems: Assuming the platform handles everything, skipping security validation in the early stages.
How to Prevent It:
Include threat modeling in design discussions.
Identify sensitive data flows early.
Document security controls (e.g., which roles can access what).
5. Security Misconfiguration
The Risk: Misconfigured app settings, servers, or exposed debug tools.
In OutSystems: Public screens/modules that should be private, default configurations, or exposed test logic.
How to Prevent It:
Review module exposure settings regularly.
Disable or delete unused modules/components.
Use HTTPS and configure security headers in environment settings.
Additionally, use a Content Security Policy (CSP) that is available in Lifetime and can be defined per environment and/or application
6. Vulnerable and Outdated Components
The Risk: Using outdated libraries or Forge components with known vulnerabilities.
In OutSystems: Relying on old or unmaintained Forge assets, which may not receive security updates or bug fixes.
How to Prevent It:
Regularly review and update Forge components used in your factory.
Prefer well-maintained and popular components with active support.
Note: Once a Forge component becomes part of your Factory, its code is essentially your responsibility. It’s common practice to exclude these components from automatic AI Mentor Studio (AIMS) analysis — which means technical debt and vulnerabilities inside them won’t be flagged automatically.
Because of that, managing Forge components is not just about updating — it’s about treating them like your own code:
Periodically check the Forge for newer versions.
Review changelogs for bug fixes or security updates.
Re-assess if the component is still necessary or if OutSystems built-in functionality can replace it.
Be cautious of components that are no longer maintained.
7. Identification and Authentication Failures
The Risk: Poor handling of login, password resets, session tokens, etc.
In OutSystems: Weak password rules, missing lockout mechanisms, exposed reset flows.
How to Prevent It:
Enforce strong password policies via OutSystems settings.
Use Multi-Factor Authentication (MFA) if supported.
Leverage external identity providers (OAuth2, SAML) securely.
8. Software and Data Integrity Failures
The Risk: Tampered deployment packages or unvalidated data imports.
In OutSystems: Directly executing scripts, importing external files without checks.
How to Prevent It:
Validate all external data inputs.
Implement integrity checks for critical data operations.
9. Security Logging and Monitoring Failures
The Risk: Inadequate logging and alerting that could detect attacks.
In OutSystems: No logs on login attempts, permission changes, or data exports.
How to Prevent It:
Log critical events using the built-in logging system or a Forge audit component.
Monitor logs for unusual behavior (do not log passwords!)
10. Server-Side Request Forgery (SSRF)
The Risk: Attackers trick your app into sending requests to internal systems.
In OutSystems: Unvalidated external URLs passed into HTTP requests.
How to Prevent It:
Validate and sanitize all URLs before making external requests.
Whitelist trusted domains or IP ranges for integrations.
Avoid exposing internal services through public APIs. But if you have to expose API, make sure they are properly secure with authentication.
Summary
OutSystems speeds up development, but speed must be balanced with security awareness. Security is not just a backend or DevOps concern — it’s part of every decision we make as developers. By understanding OWASP risks and how they appear in OutSystems apps, you’re building not just faster, but smarter and safer.
The good news? OutSystems gives you tools like the AI Mentor Studio and LifeTime to catch and fix many of these risks early.
And the best developers are not the fastest ones — they’re the ones who deliver value safely.
Comments